nervepay 1.3.6 → 1.3.9

package/bin/nervepay-cli.js

@@ -380,7 +380,7 @@ program
   .option('--code <code>', 'Pairing code from dashboard (legacy flow)')
   .option('--api-url <url>', 'NervePay API URL', DEFAULT_API_URL)
   .option('--gateway-url <url>', 'Gateway URL')
-  .option('--gateway-token <token>', 'Gateway token (only for --code flow)')
+  .option('--gateway-token <token>', 'Gateway auth token')
   .option('--name <name>', 'Gateway display name', 'OpenClaw Gateway')
   .option('--timeout <seconds>', 'Approval timeout in seconds', '300')
   .action(async (options) => {
@@ -392,6 +392,80 @@ program
     }
   });
 
+// ---------------------------------------------------------------------------
+// WebSocket connect helper (used for initial connect + reconnect polling)
+// ---------------------------------------------------------------------------
+
+function attemptConnect(WebSocket, wsUrl, ctx) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const ws = new WebSocket(wsUrl, { rejectUnauthorized: false });
+
+    function settle(fn, value) {
+      if (settled) return;
+      settled = true;
+      try { ws.close(); } catch {}
+      fn(value);
+    }
+
+    const timer = setTimeout(() => settle(reject, new Error('Connect timeout')), 15000);
+
+    ws.on('error', (e) => settle(reject, e));
+    ws.on('close', () => setTimeout(() => settle(reject, new Error('Connection closed')), 150));
+
+    ws.on('message', async (data) => {
+      try {
+        const frame = JSON.parse(data.toString());
+
+        // Challenge → sign and connect
+        if (frame.event === 'connect.challenge') {
+          const nonce = frame.payload?.nonce || '';
+          const signedAtMs = Date.now();
+          const role = 'operator';
+          const scopes = ['operator.read', 'operator.write'];
+
+          const payload = [
+            'v2', ctx.deviceId, 'node-host', 'node', role,
+            scopes.join(','), String(signedAtMs), ctx.gatewayToken, nonce,
+          ].join('|');
+
+          const payloadBytes = new TextEncoder().encode(payload);
+          const signatureB64 = await ctx.signRawBytes(ctx.privateKey, payloadBytes);
+          const signatureB64Url = signatureB64
+            .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+
+          const connectId = crypto.randomUUID();
+          ws.send(JSON.stringify({
+            type: 'req', id: connectId, method: 'connect',
+            params: {
+              role, minProtocol: 3, maxProtocol: 3, scopes,
+              client: { id: 'node-host', version: ctx.VERSION, platform: process.platform, mode: 'node' },
+              device: { id: ctx.deviceId, publicKey: ctx.pubKeyB64Url, signature: signatureB64Url, signedAt: signedAtMs, nonce },
+              auth: { token: ctx.gatewayToken },
+            },
+          }));
+
+          // Wait for response
+          ws.once('message', (resData) => {
+            clearTimeout(timer);
+            try {
+              const res = JSON.parse(resData.toString());
+              if (res.ok) {
+                const deviceToken = res.payload?.auth?.deviceToken || '';
+                settle(resolve, { token: deviceToken, payload: res.payload });
+              } else if (res.error?.code === 'NOT_PAIRED') {
+                settle(reject, new Error('NOT_PAIRED'));
+              } else {
+                settle(reject, new Error(res.error?.message || 'Connect failed'));
+              }
+            } catch { settle(reject, new Error('Invalid response')); }
+          });
+        }
+      } catch {}
+    });
+  });
+}
+
 // ---------------------------------------------------------------------------
 // Device node pairing
 // ---------------------------------------------------------------------------
@@ -412,13 +486,17 @@ async function deviceNodePairing(options) {
     logOk('Agent loaded');
     field('  DID', agentDid);
 
-    // Resolve gateway URL
+    // Resolve gateway URL and token
     let gatewayUrl = options.gatewayUrl;
-    if (!gatewayUrl) {
+    let gatewayToken = options.gatewayToken;
+    if (!gatewayUrl || !gatewayToken) {
       const oc = await readOpenClawConfig();
-      gatewayUrl = extractGatewayConfig(oc).url;
+      const gwConf = extractGatewayConfig(oc);
+      gatewayUrl = gatewayUrl || gwConf.url;
+      gatewayToken = gatewayToken || gwConf.token;
     }
     if (!gatewayUrl) die('No gateway URL found', 'Use: nervepay pair --gateway-url <url>');
+    if (!gatewayToken) die('No gateway token found', 'Use: nervepay pair --gateway-token <token>');
 
     const wsUrl = httpToWs(gatewayUrl);
     field('  Gateway', wsUrl);
@@ -432,200 +510,84 @@ async function deviceNodePairing(options) {
     logInfo('Connecting...');
 
     const WebSocket = (await import('ws')).default;
-    const ws = new WebSocket(wsUrl, { rejectUnauthorized: false });
-    const timeoutMs = parseInt(options.timeout, 10) * 1000;
-
-    // Pre-compute crypto outside WS handler to avoid async race conditions
     const pubKeyBytes = decodeBase58(publicKeyBase58);
-    // OpenClaw expects base64url encoding (no padding) for public key
     const pubKeyB64Url = Buffer.from(pubKeyBytes).toString('base64')
       .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 
-    const result = await new Promise((resolve, reject) => {
-      let settled = false;
-      let connectId = null;
-      let pairId = null;
-      let requestId = null;
-      let lastError = null;
-
-      function settle(fn, value) {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        fn(value);
-      }
-
-      const timer = setTimeout(() => {
-        ws.close();
-        settle(reject, new Error(`Approval timed out after ${options.timeout}s`));
-      }, timeoutMs + 15000);
-
-      ws.on('error', (e) => settle(reject, new Error(`Connection failed: ${e.message}`)));
+    const ctx = { deviceId, pubKeyB64Url, privateKey, gatewayToken, signRawBytes, VERSION };
+    const timeoutMs = parseInt(options.timeout, 10) * 1000;
 
-      ws.on('close', (code, reason) => {
-        setTimeout(() => {
-          const detail = lastError || (reason?.toString() ? `${reason}` : `code ${code}`);
-          settle(reject, new Error(detail));
-        }, 150);
-      });
+    // First attempt
+    let deviceToken = '';
+    try {
+      const result = await attemptConnect(WebSocket, wsUrl, ctx);
+      deviceToken = result.token;
+      logOk('Connected (device already paired)');
+    } catch (e) {
+      if (e.message !== 'NOT_PAIRED') throw e;
 
-      ws.on('message', async (data) => {
-        try {
-          const frame = JSON.parse(data.toString());
-          logDebug('<<', JSON.stringify(frame).slice(0, 300));
-
-          // Challenge → build auth payload, sign, and connect
-          if (frame.event === 'connect.challenge') {
-            const nonce = frame.payload?.nonce || '';
-            logOk('Challenge received');
-
-            const signedAtMs = Date.now();
-            const role = 'operator';
-            const scopes = ['operator.read', 'operator.write'];
-
-            // Build structured payload per OpenClaw device-auth protocol (v2)
-            // Format: v2|deviceId|clientId|clientMode|role|scopes|signedAtMs|token|nonce
-            const payload = [
-              'v2',
-              deviceId,
-              'node-host',
-              'node',
-              role,
-              scopes.join(','),
-              String(signedAtMs),
-              '',  // token (empty for initial connect)
-              nonce,
-            ].join('|');
-
-            logDebug('Auth payload:', payload);
-
-            const payloadBytes = new TextEncoder().encode(payload);
-            const signatureB64 = await signRawBytes(privateKey, payloadBytes);
-            // Convert to base64url (no padding)
-            const signatureB64Url = signatureB64
-              .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
-
-            connectId = crypto.randomUUID();
-            ws.send(JSON.stringify({
-              type: 'req',
-              id: connectId,
-              method: 'connect',
-              params: {
-                role,
-                minProtocol: 3,
-                maxProtocol: 3,
-                scopes,
-                client: {
-                  id: 'node-host',
-                  version: VERSION,
-                  platform: process.platform,
-                  mode: 'node',
-                },
-                device: {
-                  id: deviceId,
-                  publicKey: pubKeyB64Url,
-                  signature: signatureB64Url,
-                  signedAt: signedAtMs,
-                  nonce,
-                },
-              },
-            }));
-            return;
-          }
+      // Device needs pairing approval — poll reconnect until approved
+      logOk('Pairing request created');
+      console.log();
+      logInfo('Waiting for gateway owner approval...');
+      log(dim('  Approve on gateway: openclaw devices approve'));
+      log(dim(`  Timeout: ${options.timeout}s`));
+      console.log();
 
-          // Connect response
-          if (frame.type === 'res' && frame.id === connectId) {
-            if (frame.ok) {
-              logOk('Connected to gateway');
-
-              pairId = crypto.randomUUID();
-              ws.send(JSON.stringify({
-                type: 'req',
-                id: pairId,
-                method: 'node.pair.request',
-                params: {
-                  displayName: `NervePay (${agentDid.split(':').pop().slice(0, 8)})`,
-                  platform: process.platform,
-                },
-              }));
-            } else {
-              lastError = formatFrameError('Connect rejected', frame);
-              logErr(lastError);
-              ws.close();
-              settle(reject, new Error(lastError));
-            }
-            return;
-          }
+      const pollInterval = 5000;
+      const maxAttempts = Math.ceil(timeoutMs / pollInterval);
+      let approved = false;
 
-          // Pair response
-          if (frame.type === 'res' && frame.id === pairId) {
-            if (frame.ok) {
-              requestId = frame.payload?.requestId || '';
-              logOk('Pairing request submitted');
-              console.log();
-              logInfo('Waiting for gateway owner approval...');
-              log(dim(`Approve: openclaw devices approve ${requestId}`));
-              log(dim(`Timeout: ${options.timeout}s`));
-              console.log();
-            } else {
-              lastError = formatFrameError('Pair rejected', frame);
-              logErr(lastError);
-              ws.close();
-              settle(reject, new Error(lastError));
-            }
-            return;
-          }
+      for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        await new Promise(r => setTimeout(r, pollInterval));
+        process.stdout.write(dim('.'));
 
-          // Pair resolved
-          if (frame.event === 'node.pair.resolved') {
-            const rid = frame.payload?.requestId;
-            if (rid && rid !== requestId) return;
-
-            const decision = frame.payload?.decision;
-            if (decision === 'approved') {
-              ws.close();
-              settle(resolve, {
-                token: frame.payload?.token || '',
-                nodeId: frame.payload?.nodeId || '',
-                requestId,
-              });
-            } else {
-              ws.close();
-              settle(reject, new Error(decision === 'rejected'
-                ? 'Pairing rejected by gateway owner'
-                : `Unexpected decision: ${decision}`));
-            }
-            return;
+        try {
+          const result = await attemptConnect(WebSocket, wsUrl, ctx);
+          deviceToken = result.token;
+          approved = true;
+          console.log();
+          break;
+        } catch (retryErr) {
+          if (retryErr.message !== 'NOT_PAIRED') {
+            console.log();
+            throw retryErr;
           }
+        }
+      }
+      if (!approved) die(`Approval timed out after ${options.timeout}s`);
+    }
 
-          // Unhandled
-          logDebug('Unhandled frame:', JSON.stringify(frame).slice(0, 200));
-        } catch { /* non-JSON */ }
-      });
-    });
-
-    logOk(bold('Approved!'));
+    logOk(bold('Paired!'));
     console.log();
-    logInfo('Saving to NervePay...');
 
-    const client = new NervePayClient({
-      apiUrl: options.apiUrl || apiUrl,
-      agentDid,
-      privateKey,
-    });
+    if (deviceToken) {
+      logInfo('Saving to NervePay...');
+      const client = new NervePayClient({
+        apiUrl: options.apiUrl || apiUrl,
+        agentDid,
+        privateKey,
+      });
 
-    const apiResult = await gateway.completeDevicePairing(client, {
-      device_token: result.token,
-      device_id: deviceId,
-      gateway_url: gatewayUrl,
-      gateway_name: options.name,
-    });
+      const apiResult = await gateway.completeDevicePairing(client, {
+        device_token: deviceToken,
+        device_id: deviceId,
+        gateway_url: gatewayUrl,
+        gateway_name: options.name,
+      });
 
-    divider();
-    logOk(bold('Gateway paired'));
-    field('  Gateway ID', apiResult.gateway_id);
-    field('  Device ID', deviceId.slice(0, 16) + '...');
-    field('  Agent DID', agentDid);
+      divider();
+      logOk(bold('Gateway paired'));
+      field('  Gateway ID', apiResult.gateway_id);
+      field('  Device ID', deviceId.slice(0, 16) + '...');
+      field('  Agent DID', agentDid);
+    } else {
+      divider();
+      logOk(bold('Device approved by gateway'));
+      field('  Device ID', deviceId.slice(0, 16) + '...');
+      field('  Agent DID', agentDid);
+      log(warn('  No device token received — gateway may not issue tokens for this role'));
+    }
     console.log();
     log(dim('View in dashboard:'), info('Mission Control > Task Board'));
     console.log();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervepay",
-  "version": "1.3.6",
+  "version": "1.3.9",
   "description": "NervePay plugin for OpenClaw - Self-sovereign identity, vault, and orchestration",
   "type": "module",
   "main": "dist/index.js",